Public repository contains Remote Code Execution vulnerability

[Frantz Galinier-Stefani]

Hello,

The following public repository contains malicious code:
https://bitbucket.org/ethvault-tech-team/ethvault/src/master/

In file server/controllers/productController.js, the function `getCookie` downloads arbitrary code from:
https://api.mocki.io/v2/964ug6uu
and executes it locally using `new Function(...)` with `require`.

This is a Remote Code Execution vulnerability that could fully compromise a user’s machine.
The repository has been online since July 10, 2025 and is being shared with job candidates as a “technical test”.

Please investigate and take action to remove or restrict this repository.

[Mikael Sandberg]

Hi @Frantz Galinier-Stefani,

Welcome to Atlassian Community!

Please report this to abuse@atlassian.com and they will take action on it. Just note that the team will not reply back. 

[Frantz Galinier-Stefani]

Ok, thx